CVE-2025-27234: Zabbix Agent 2 smartctl plugin RCE vulnerability in Zabbix 5.0.

Severity: high (CVSS 7.3 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-09-12 · updated 2026-10-19
Weakness: CWE-78

Description

Zabbix Agent 2 smartctl plugin does not properly sanitize smart.disk.get parameters, allowing an attacker to inject unexpected arguments into the smartctl command. In Zabbix 5.0 this allows for remote code execution.

References

https://support.zabbix.com/browse/ZBX-26985
https://lists.debian.org/debian-lts-announce/2026/02/msg00012.html

Get alerted when CVE-2025-27234 or the next vulnerability affects your stack